Spain

AXESOR CONOCER PARA DECIDIR S.A.U.

128,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-09-21.

Rank · Sector

#82

of 335 in Finance, Insurance and Consulting

Rank · Spain

#99

of 1,114

Rank · All fines

#459

of 3,223

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-09-21
Controller / Processor: AXESOR CONOCER PARA DECIDIR S.A.U.
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 6 (1) GDPR, Art. 14 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 128,000 on Axesor Conocer para Decidir S.A.U. Following a complaint from a sole trader, it was discovered that data from the Chamber of Commerce's public business census was being resold and published. Since 2009, the controller had been sold a file containing the names, addresses, tax IDs, phone numbers and activities of sole traders. This file covered a total of 1,670,000 sole traders. The controller used this data to enrich their database and sell marketing lists to between 500 and 900 clients per year. In 2022, the controller published sole traders' names, ID numbers, addresses, court cases and financial solvency. From 2024 onwards, ID numbers and court cases were no longer available, and from 2025 onwards, users needed an account to access this information. The AEPD found no legal basis for processing the personal data of sole traders as it had been obtained for census purposes. Both the Chamber of Commerce (ETid-2874) and its subsidiary Camerdata (ETid-2838) were fined aswell.

Open original source Links to the regulator's original publication or another source.